Code Monkey home page Code Monkey logo

firewall4's Introduction

OpenWrt logo

OpenWrt Project is a Linux operating system targeting embedded devices. Instead of trying to create a single, static firmware, OpenWrt provides a fully writable filesystem with package management. This frees you from the application selection and configuration provided by the vendor and allows you to customize the device through the use of packages to suit any application. For developers, OpenWrt is the framework to build an application without having to build a complete firmware around it; for users this means the ability for full customization, to use the device in ways never envisioned.

Sunshine!

Download

Built firmware images are available for many architectures and come with a package selection to be used as WiFi home router. To quickly find a factory image usable to migrate from a vendor stock firmware to OpenWrt, try the Firmware Selector.

If your device is supported, please follow the Info link to see install instructions or consult the support resources listed below.

An advanced user may require additional or specific package. (Toolchain, SDK, ...) For everything else than simple firmware download, try the wiki download page:

Development

To build your own firmware you need a GNU/Linux, BSD or macOS system (case sensitive filesystem required). Cygwin is unsupported because of the lack of a case sensitive file system.

Requirements

You need the following tools to compile OpenWrt, the package names vary between distributions. A complete list with distribution specific packages is found in the Build System Setup documentation.

binutils bzip2 diff find flex gawk gcc-6+ getopt grep install libc-dev libz-dev
make4.1+ perl python3.7+ rsync subversion unzip which

Quickstart

  1. Run ./scripts/feeds update -a to obtain all the latest package definitions defined in feeds.conf / feeds.conf.default

  2. Run ./scripts/feeds install -a to install symlinks for all obtained packages into package/feeds/

  3. Run make menuconfig to select your preferred configuration for the toolchain, target system & firmware packages.

  4. Run make to build your firmware. This will download all sources, build the cross-compile toolchain and then cross-compile the GNU/Linux kernel & all chosen applications for your target system.

Related Repositories

The main repository uses multiple sub-repositories to manage packages of different categories. All packages are installed via the OpenWrt package manager called opkg. If you're looking to develop the web interface or port packages to OpenWrt, please find the fitting repository below.

  • LuCI Web Interface: Modern and modular interface to control the device via a web browser.

  • OpenWrt Packages: Community repository of ported packages.

  • OpenWrt Routing: Packages specifically focused on (mesh) routing.

  • OpenWrt Video: Packages specifically focused on display servers and clients (Xorg and Wayland).

Support Information

For a list of supported devices see the OpenWrt Hardware Database

Documentation

Support Community

  • Forum: For usage, projects, discussions and hardware advise.
  • Support Chat: Channel #openwrt on oftc.net.

Developer Community

License

OpenWrt is licensed under GPL-2.0

firewall4's People

Contributors

jow- avatar luizluca avatar nbd168 avatar stintel avatar systemcrash avatar t-8ch avatar tiagogaspar8 avatar

Stargazers

avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar

Watchers

avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar

Forkers

luizluca efahl hartl3y94 abu33 devdevdany aikonlee seanpm2001 jonathanunderwood rany2 brada4

firewall4's Issues

creating NOTRACK firewall rules are bogus

In my case , i want to remove connection tracking on DNS on my local network only .

I added 2 rules

extract of /etc/config/firewall

# rule A
config rule
	option name 'dont track DNS queries'
	option src 'lan'
	option dest_port '53'
	option target 'NOTRACK'
# rule B
config rule
	option name 'dont track DNS queries'
	option src_port '53'
	option dest 'lan'
	option target 'NOTRACK'
  1. rule A is too wide , because capture packet in forward mode

current nft ruleset

	chain raw_prerouting {
		type filter hook prerouting priority raw; policy accept;
		iifname "br-lan" jump notrack_lan comment "!fw4: Handle lan IPv4/IPv6 notrack traffic"
	}

	chain notrack_lan {
		tcp dport 53 counter packets 0 bytes 0 notrack comment "!fw4: dont track DNS queries"
		udp dport 53 counter packets 1298 bytes 91957 notrack comment "!fw4: dont track DNS queries"
	}

the rule in raw_prerouting must be something like this

      iifname "br-lan" fib daddr . iif type local  jump notrack_lan comment "!fw4: Handle lan IPv4/IPv6 notrack traffic"
  1. rule B does not generate nft rule

so firewall4 must generate a block like this

	chain raw_output {
		type filter hook output priority raw; policy accept;
		oifname "br-lan" jump notrack_output_lan comment "!fw4: Handle lan IPv4/IPv6 notrack output traffic"
	}
	chain notrack_output_lan {
		tcp sport 53 counter packets 0 bytes 0 notrack comment "!fw4: dont track DNS queries"
		udp sport 53 counter packets 921 bytes 73525 notrack comment "!fw4: dont track DNS queries"
	}

fw4 assumes ether_addr sets are ipv4 only

Given the following uci configuration:

	add firewall rule
	set firewall.@rule[-1].name='Forward-auth-captive'
	set firewall.@rule[-1].src="captivezone"
	set firewall.@rule[-1].dest='wan'
	set firewall.@rule[-1].proto='any'
	set firewall.@rule[-1].target='ACCEPT'
	set firewall.@rule[-1].ipset='captive'
 
	add firewall ipset
	set firewall.@ipset[-1].name='captive'
	add_list firewall.@ipset[-1].match='src_mac'

firewall4 produces the following rules:

table inet fw4 {
	set captive {
		type ether_addr
		elements = { }
        }

[...]

	chain forward_captivezone {
		meta nfproto ipv4 ether saddr @captive counter packets 111598 bytes 30867442 jump accept_to_wan comment "!fw4: Forward-auth-captive"

The meta nfproto ipv4 match is unwarranted as the relative set is address agnostic.

[feature request] support DNAT on the NAT output chain

I want to redirect all traffic from LAN to WAN IP1 (or an ipset) to WAN IP2. For now, this can be accomplished by the DNAT rule:

config redirect
        option target 'DNAT'
        option name 'IP1-IP2'
        option family 'ipv4'
        option src 'lan'
        option ipset 'IPSET1'
        option dest_ip 'IP2'
        list proto 'all'

which will generate the following nftables rule:

chain dstnat_lan {
        ip daddr @IPSET1 counter packets 0 bytes 0 dnat ip to IP2 comment "!fw4: IP1-IP2"
}

However, the dstnat_lan chain is part of the nat postrouting chain so it will apply to devices behind the router, not the router itself.

To enable the redirection for the router, I have to resort to a custom nftables rule:

chain user_pre_output_nat {
    type nat hook output priority -1; policy accept;
    ip daddr @IPSET1 counter dnat ip to IP2
}

Please make fw4 capable of generating DNAT rules on the nat output chain that suppresses my custom rule.

Adding log to zone defines rule.jump_chain with invalid chain name

Hello,

With:

        "zone": [
                {
                        ".description": "test zone",
                        "name": "test1",
                        "log": 1,
                        "log_limit": "1/min"
                }
        ],
        "rule": [
                {
                        ".description": "src test1 log",
                        "proto": "tcp",
                        "src": "test1",
                        "dest_port": 1,
                        "log": 1
                },
         ]

I get

{ "enabled": true, "name": "@rule[0]", "src": { "any": false, "zone": { "enabled": true, "name": "test1", "input": "drop", "output": "drop", "forward": "drop", "log": 1, "log_limit": { "invert": false, "val": "1/min", "rate": 1, "unit": "minute" }, "auto_helper": true, "counter": true, "network": [ ], "family": null, "match_rules": [ ], "masq4_src_subnets": [ [ null, null, null ] ], "masq4_dest_subnets": [ [ null, null, null ] ], "masq6_src_subnets": [ [ null, null, null ] ], "masq6_dest_subnets": [ [ null, null, null ] ], "sflags": { "drop": true }, "dflags": { "drop": true, "helper": true }, "match_devices": [ ], "match_subnets": [ ], "related_subnets": [ ], "related_physdevs": [ ] } }, "proto": { "invert": false, "val": "tcp", "name": "tcp" }, "dest_port": [ { "invert": false, "val": "1", "min": 1, "max": 1 } ], "counter": true, "log": "@rule[0]: ", "family": 0, "has_addrs": false, "has_ports": true, "saddrs_pos": null, "saddrs_neg": null, "saddrs_masked": null, "daddrs_pos": null, "daddrs_neg": null, "daddrs_masked": null, "sports_pos": null, "sports_neg": null, "dports_pos": [ "1" ], "dports_neg": null, "smacs_pos": null, "smacs_neg": null, "chain": "input_test1", "jump_chain": "null_from_test1" }

While with log:0 in zone, I get:

{ "enabled": true, "name": "@rule[0]", "src": { "any": false, "zone": { "enabled": true, "name": "test1", "input": "drop", "output": "drop", "forward": "drop", "log": 0, "log_limit": { "invert": false, "val": "1/min", "rate": 1, "unit": "minute" }, "auto_helper": true, "counter": true, "network": [ ], "family": null, "match_rules": [ ], "masq4_src_subnets": [ [ null, null, null ] ], "masq4_dest_subnets": [ [ null, null, null ] ], "masq6_src_subnets": [ [ null, null, null ] ], "masq6_dest_subnets": [ [ null, null, null ] ], "sflags": { "drop": true }, "dflags": { "drop": true, "helper": true }, "match_devices": [ ], "match_subnets": [ ], "related_subnets": [ ], "related_physdevs": [ ] } }, "proto": { "invert": false, "val": "tcp", "name": "tcp" }, "dest_port": [ { "invert": false, "val": "1", "min": 1, "max": 1 } ], "counter": true, "log": "@rule[0]: ", "family": 0, "has_addrs": false, "has_ports": true, "saddrs_pos": null, "saddrs_neg": null, "saddrs_masked": null, "daddrs_pos": null, "daddrs_neg": null, "daddrs_masked": null, "sports_pos": null, "sports_neg": null, "dports_pos": [ "1" ], "dports_neg": null, "smacs_pos": null, "smacs_neg": null, "chain": "input_test1" }

The difference, besides the expected rule.src.zone.log=1, is in the extra "jump_chain" with "null_from_test1" value. The result is:

-               tcp dport 1 counter comment "!fw4: @rule[0]"
+               tcp dport 1 counter jump null_from_test1 comment "!fw4: @rule[0]"

I'm not sure where this jump came from.

This bogus jump_chain can also be triggered with:

                {
                        ".description": "Source any, dest test1, no log",
                        "proto": "tcp",
                        "src": "*",
                        "dest": "test1",
                        "dest_port": 6,
                        "log": 0
                },

In this case, no matter the zone.log state.

weird quic freezes because of ct timeout

firefox tries 300s keeplaive for udp stream
gcp responds with 120s
chromium uses 30s
as a result firefox doesnt perform well like yt freezing, maps stuck etc against google at least.

particular 433/udp streams should have their timeout adjusted to 300s to adapt to the facts life (default 30s, patching kernel to count 5+packets each way in kernel to become stream would fix current moment issue)
id' do a PR but i dot feel strong to s/accept/udp 53 ct tmout \; accept/+

fw4 doesn't reset tables beside fw4

I'm trying to add the following fragment

table bridge fw4 {
        chain mangle_prerouting {
                type filter hook prerouting priority -150; policy accept;
                iifname "phy0-ap0" meta mark set 0x00000001
        }
}

to some file in /usr/share/nftables.d/ruleset-post/example.nft.

This include is then properly loaded, however fw4 doesn't seem to reset any other table besides fw4.

This leads to the situation that the rule iifname "phy0-ap0" meta mark set 0x00000001 is added again and again.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.